The question behind the term
Encryption becomes end-to-end only when plaintext and the keys needed to read it stay with intended participant endpoints. TLS protects a network hop, and server-side encryption protects storage, but both leave a service boundary able to read content.
A reviewable approach
Document key creation, identity verification, message-key derivation, authenticated encryption, attachment handling, rotation and recovery. Pair the protocol with user states for missing keys, changed fingerprints and unrecoverable history.
- Define the endpoint and adversary
- Authenticate ciphertext and context
- Fail closed when required identities are missing
- Test recovery and key rotation across clients
The boundary to keep visible
E2EE does not prove endpoint safety, erase metadata or make every conversation type equivalent. Hybrid cryptography also needs implementation review; naming a post-quantum primitive is not an independent security guarantee.